Running Docker as non-root user

问题:

I'm trying to run docker as a non-root user. When I try, I get the following error:

$ docker ps
FATA[0000] Get http:///var/run/docker.sock/v1.18/containers/json: dial unix /var/run/docker.sock: permission denied. Are you trying to connect to a TLS-enabled daemon without TLS? 

I can run docker as root:

$ sudo docker ps
CONTAINER ID        IMAGE               COMMAND             CREATED             STATUS              PORTS               NAMES
[...]

I've put this user into a Unix group docker:

$ groups
domain users docker suappprod stashadmin config_mgmt remote server access sudevmail sudevsvn

However, it still appears that this user cannot run most of the docker commands without sudoing as root.

I am on an older version of docker:

$ docker --version
Docker version 1.6.1, build a8a31ef/1.6.1

I know that the latest is 1.10, and it's possible for our company to update all of the docker installs to 1.9.2, but that will take a lot of effort and time.

Is there something else I need to look at? The user has been logged in and out multiple times. I have not rebooted the system yet.

回答1:

Check what this command gives --> ls -l /var/run/docker.sock You may want to change the permissions of this file using chmod (Ex: sudo chmod 777 /var/run/docker.sock) depending on what permissions you want to give.

回答2:

Adding users to the Docker group (since Docker group has full control to the socket)

As root, add the user to the docker group:

• Cat /etc/group
• gpasswd -a <username> docker
• Exit (as root)
• Log off
• Log in as the user, and attempt to run "Docker PS" to validate.

This is how I've been able to set it up on my Ubuntu systems time and time again.

回答3:

My docker version is 17.06.1-ce, build 874a737 on Ubuntu 16.04.3 LTS
For linux distro that using systemd there is service named docker.socket

linux@linux-ubuntu:~$ sudo systemctl status docker.socket
● docker.socket - Docker Socket for the API
   Loaded: loaded (/lib/systemd/system/docker.socket; disabled; vendor preset: enab
       Active: active (running) since Sab 2017-08-26 01:15:26 WIB; 9min ago
   Listen: /var/run/docker.sock (Stream)

Agu 26 01:15:26 hasto-ubuntu systemd[1]: Starting Docker Socket for the API.
Agu 26 01:15:26 hasto-ubuntu systemd[1]: Listening on Docker Socket for the API.
linux@linux-ubuntu:~$ 

The file location is at /lib/systemd/system/docker.socket

linux@linux-ubuntu:~$ cat /lib/systemd/system/docker.socket 
[Unit]
Description=Docker Socket for the API
PartOf=docker.service

[Socket]
ListenStream=/var/run/docker.sock
SocketMode=0660
SocketUser=root
SocketGroup=docker

[Install]
WantedBy=sockets.target
linux@linux-ubuntu:~$ 

From that file we can change SocketMode=0660 into SocketMode=0666

Restart docker.socket

systemctl restart docker.socket

Our docker socket permission will be 066 means every user can read and write into it.

Every user can now run docker command as non-root user.

linux@linux-ubuntu:~$ docker ps -a
CONTAINER ID        IMAGE                    COMMAND                  CREATED      STATUS                  PORTS  NAMES
03eb2ba2eacd        google/cadvisor:latest   "/usr/bin/cadvisor..."   5 weeks ago  Exited (0) 5 weeks ago         elk_cadvisor_1
52efa40edf3a        portainer/portainer      "/portainer"             7 weeks ago  Exited (2) 11 days ago         portainer
linux@linux-ubuntu:~$ 

linux@linux-ubuntu:~$ docker images
REPOSITORY          TAG                      IMAGE ID            CREATED           SIZE
portainer/portainer latest                   96196eaa6b3         8 weeks ago       10.4MB
google/cadvisor     latest                   f9ba08bafdea        5 months ago      57.3MB
linux@linux-ubuntu:~$ 

Be aware of non-root access to docker command Why we don't let non-root users run Docker in CentOS, Fedora, or RHEL

Reference :

1. Docker Documentation : Control and configure Docker with systemd
2. Github docker systemd